Still, they're a tiny and cash-starved company so we can't expect too much of them.
I don't know if GCP has a free tier like AWS does, but 10kQPS is likely within the capability of a free EC2 instance running nginx with a static redirect map. Maybe splurge for the one with a full GB of RAM? No problem.
You can serve immense volumes of traffic from static html. One hardware server alone could so easily do the job.
Your attack surface is also tiny without a back end interpreter.
People will chime in with redundancy, but the point is Google could stop maintaining the ingress, and still not be douches about existing urls.
But... you know, it's Google.
Why break this??
Sure, deprecate the service. Add no new entries. This is a good idea anyway, link shorteners are bad for the internet.
But breaking all the existing goo.gl URLs seems bizarrely hostile, and completely unnecessary. It would take so little to keep them up.
You don't even need HTML files. The full set of static redirects can be configured into the webserver. No deployment hassles. The filesystem can be RO to further reduce attack surface.
Google is acting like they are a one-person startup here.
Since they are not a one-person startup, I do wonder if we're missing the real issue. Like legal exposure, or implication in some kind of activity that they don't want to be a part of, and it's safer/simpler to just delete everything instead of trying to detect and remove all of the exposure-creating entries.
Of maybe that's what they're telling themselves, even if it's not real.
We already told you: people are likely brute-forcing URLs.
This sounds like a good project for an intern, with server costs that might be able to exceed a hundred dollars per month!
Oh, my sweet summer child. Try tens of thousands of QPS from bots trying to brute-force URLs to sensitive materials - and some likely succeeding!